In SDN solutions, some networking services are provided by the SDN itself, for example
However, there are still some services which are not supported by the SDN provider, for example
In this case, the CloudStack VR is used to provide Dhcp, Dns and Userdata services to the VM instances, while remaining out of the data path, acting as a helper VM
The goal of this feature is to support VPN access from the Cloudstack VR when its out of the data path, thus supporting:
Please note, this supports VPC only. Isolated networks is not supported
As a pre-requisite, the CloudStack VR needs to be provided with a public IP (via Static NAT).
For Remote access vpn, the diagram is as below
For Site-to-Site VPN, the diagram is as below
In both cases, static routes need to be injected by CloudStack in the SND fabric.
This described some details of the implementation
user_ip_address for public ip address, which indicates if the ip is used for 1:1 NAT to the VPC VR.`for_router` tinyint(1) DEFAULT '0' COMMENT 'True if the ip address is used by Domain Router to expose services',
static_routes , which saves the next hop of static routes.`next_hop`varchar(50) COMMENT "next hop of the static route" AFTER `vpc_gateway_id`
root@r-26-VM:~# cat /etc/ipsec.d/l2tp.conf
#ipsec remote access vpn configuration
conn L2TP-PSK
authby=secret
rekey=no
keyingtries=3
leftfirewall=yes
type=transport
left=172.17.1.67 (private IP of first guest NIC)
leftid=10.0.88.10 (public IP of VPC VR)
leftprotoport=udp/l2tp
right=%any
rightprotoport=udp/%any
rightsubnetwithin=0.0.0.0/0
auto=route
root@r-26-VM:~# cat /etc/ipsec.d/ipsec.any.secrets
: PSK "4QCNMeE9RjDccgYgPzZZmnkc"
|
for xl2tpd and vpn users
root@r-26-VM:~# cat /etc/xl2tpd/xl2tpd.conf [lns default] ip range = 10.1.2.2-10.1.2.8 local ip = 10.1.2.1 require chap = yes refuse pap = yes pppoptfile = /etc/ppp/options.xl2tpd root@r-26-VM:~# cat /etc/ppp/chap-secrets # Secrets for authentication using CHAP # client server secret IP addresses test1 * test1 * test2 * test2 * test3 * test3 * |
root@r-26-VM:~# cat /etc/ipsec.d/ipsec.vpn-10.0.80.31.conf #conn for vpn-10.0.80.31 conn vpn-10.0.80.31 left=172.17.1.67 (private IP of first guest NIC) leftid=10.0.88.10 (public IP of VPC VR) # leftsourceip=10.0.88.10 leftsubnet=172.17.0.0/20 right=10.0.80.31 rightsubnet=172.27.0.0/20 type=tunnel authby=secret keyexchange=ike ike=aes128-sha1-modp1536 ikelifetime=1440m esp=aes128-sha1 lifetime=60m keyingtries=2 auto=route forceencaps=yes dpddelay=30 dpdtimeout=120 dpdaction=restart root@r-26-VM:~# cat /etc/ipsec.d/ipsec.vpn-10.0.80.31.secrets 10.0.88.10 10.0.80.31 : PSK "test2" |
# This is an example # 172.17.1.67 is the private IP of first guest NIC of VPC VR root@dummy-gateway-002:~# ip route default via 10.0.80.1 dev ens3 10.0.80.0/20 dev ens3 proto kernel scope link src 10.0.88.1 10.1.2.0/24 via 172.17.1.67 dev ens8 # For Remote Access VPN, the IP range is 10.1.2.1-10.1.2.8 172.17.1.0/24 dev ens8 proto kernel scope link src 172.17.1.1 172.17.2.0/24 dev ens9 proto kernel scope link src 172.17.2.1 172.25.0.0/20 via 172.17.1.67 dev ens8 # For Site-to-Site VPN 172.27.0.0/20 via 172.17.1.67 dev ens8 # For Site-to-Site VPN |
To create a VPC, please refer to https://docs.cloudstack.apache.org/en/4.19.1.0/adminguide/networking_and_traffic.html#configuring-a-virtual-private-cloud
In SDN networks, remote access VPN is not supported on the Source NAT IP.
(1) acquire a Public IP
Please use an IP address which is in the VPN fabric.
(2) Enable Remote Access VPN
the pre-shared key is displayed
(3) Connect in VPN Client
Please refer to https://docs.cloudstack.apache.org/en/4.19.1.0/adminguide/networking/using_remote_access.html#microsoft-windows-8
Reminder, for Windows clients,
Allow MSCHAP-v2
(1) Create VPN gateway
If remote access VPN is enabled, the same public IP is used, otherwise CloudStack automatically assigns a Public IP.
(2) Create customer gateway
(3) Create VPN connection
Before testing
Test cases | Check items and expected results |
|---|---|
Create VPC, VPC tier and VM | |
|
|
|
|
|
|
Setup Remote Access VPN | |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Setup Site-to-Site VPN | |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Setup both Remote Access VPN and S2S VPN | |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Test VPC tier creation | |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Test VPC tier deletion (first tier) | |
|
|
|
|
|
|
|
|
|
|
Test VPC VR reboot | |
|
|
|
|
|
|
|
|
Test VPC restart with cleanup | |
|
|
|
|
|
|
|
|
Test VPC tier deletion (from last tier) | |
|
|
|
|
|
|
|
|
|
|